How do I install the Cis Docker V160 2.14 skill?

Run npx skillmds@latest add cyberstrikeus/cis-docker-v160-2-14 in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Cis Docker V160 2.14 skill do?

Ensure containers are restricted from acquiring new privileges It is listed under DevOps & Infra on SkillMD.

Is Cis Docker V160 2.14 safe to use?

SkillMD's automated safety review verdict for this skill is PASS. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Cis Docker V160 2.14?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Cis Docker V160 2.14 free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Cis Docker V160 2.14?

cyberstrikeus (@cyberstrikeus) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Cis Docker V160 2.14 by cyberstrikeus

Name: Cis Docker V160 2.14
Author: cyberstrikeus

File contents

Ensure containers are restricted from acquiring new privileges

Profile Applicability: Level 1 - Docker - Linux

Assessment Status: Manual

Description

By default you should restrict containers from acquiring additional privileges via suid or sgid.

Rationale

A process can set the no_new_priv bit in the kernel and this persists across forks, clones and execve. The no_new_priv bit ensures that the process and its child processes do not gain any additional privileges via suid or sgid bits. This reduces the security risks associated with many dangerous operations because there is a much reduced ability to subvert privileged binaries.

Setting this at the daemon level ensures that by default all new containers are restricted from acquiring new privileges.

Impact

no_new_priv prevents LSMs such as SELinux from escalating the privileges of individual containers.

Audit Procedure

To confirm this setting, you should review the dockerd start-up options and a check of any settings in /etc/docker/daemon.json -sca should also be carried out. To review the dockerd startup options, the following command can be used:

ps -ef | grep dockerd

You should ensure that the --no-new-privileges parameter is present and that it is not set to false. The contents of /etc/docker/daemon.json should also be reviewed.

Remediation

You should run the Docker daemon as below:

dockerd --no-new-privileges

Default Value

By default, containers are not restricted from acquiring new privileges.

References

CIS Controls

Controls Version	Control	IG 1	IG 2	IG 3
v8	6.1 Establish an Access Granting ProcessEstablish and follow a process, preferably automated, for granting access to enterprise assets upon new hire, grant, or role change of a user.	●	●	●
v7	4 Controlled Use of Administrative PrivilegesControlled Use of Administrative Privileges

Profile/Assessment Status

Profile: Level 1 - Docker - Linux Assessment Status: Manual

---name: cis-docker-v160-2-14description: Ensure containers are restricted from acquiring new privileges---# Ensure containers are restricted from acquiring new privileges**Profile Applicability:** Level 1 - Docker - Linux**Assessment Status:** Manual## DescriptionBy default you should restrict containers from acquiring additional privileges via suid or sgid.## RationaleA process can set the `no_new_priv` bit in the kernel and this persists across forks, clones and execve. The `no_new_priv` bit ensures that the process and its child processes do not gain any additional privileges via suid or sgid bits. This reduces the security risks associated with many dangerous operations because there is a much reduced ability to subvert privileged binaries.Setting this at the daemon level ensures that by default all new containers are restricted from acquiring new privileges.## Impact`no_new_priv` prevents LSMs such as SELinux from escalating the privileges of individual containers.## Audit ProcedureTo confirm this setting, you should review the dockerd start-up options and a check of any settings in `/etc/docker/daemon.json` -sca should also be carried out.To review the dockerd startup options, the following command can be used:```bashps -ef | grep dockerd```You should ensure that the `--no-new-privileges` parameter is present and that it is not set to `false`.The contents of `/etc/docker/daemon.json` should also be reviewed.## RemediationYou should run the Docker daemon as below:```bashdockerd --no-new-privileges```## Default ValueBy default, containers are not restricted from acquiring new privileges.## References1. https://docs.docker.com/engine/reference/commandline/dockerd/2. https://github.com/moby/moby/pull/20727## CIS Controls| Controls Version | Control | IG 1 | IG 2 | IG 3 || ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---- | ---- | ---- || v8 | 6.1 Establish an Access Granting Process<br>Establish and follow a process, preferably automated, for granting access to enterprise assets upon new hire, grant, or role change of a user. | ● | ● | ● || v7 | 4 Controlled Use of Administrative Privileges<br>Controlled Use of Administrative Privileges | | | |## Profile/Assessment Status**Profile:** Level 1 - Docker - Linux**Assessment Status:** Manual

Frequently asked questions

Cis Docker V160 2.14